Enforce length/size limits for variable size heap object in order to

vm/dart_api_impl.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "include/dart_api.h"
 
 #include "vm/bigint_operations.h"
 #include "vm/class_finalizer.h"
 #include "vm/compiler.h"
 #include "vm/dart.h"
@@ skipping 1561 matching lines @@
                          CURRENT_FUNC);
   }
   return Api::NewHandle(isolate, String::New(str));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewString8(const uint8_t* codepoints,
                                         intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  if (length < 0 || length > OneByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, OneByteString::kMaxElements);
+  }
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewString16(const uint16_t* codepoints,
                                          intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  if (length < 0 || length > TwoByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, TwoByteString::kMaxElements);
+  }
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewString32(const uint32_t* codepoints,
                                          intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (codepoints == NULL) {
+    RETURN_NULL_ERROR(codepoints);
+  }
+  if (length < 0 || length > FourByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, FourByteString::kMaxElements);
+  }
   return Api::NewHandle(isolate, String::New(codepoints, length));
 }
 
 
 DART_EXPORT bool Dart_IsExternalString(Dart_Handle object) {
   return RawObject::IsExternalStringClassId(Api::ClassId(object));
 }
 
 
 DART_EXPORT Dart_Handle Dart_ExternalStringGetPeer(Dart_Handle object,
@@ skipping 37 matching lines @@
 
 DART_EXPORT Dart_Handle Dart_NewExternalString16(const uint16_t* codepoints,
                                                  intptr_t length,
                                                  void* peer,
                                                  Dart_PeerFinalizer callback) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   if (codepoints == NULL && length != 0) {
     RETURN_NULL_ERROR(codepoints);
   }
-  if (length < 0) {
-    return Api::NewError("%s expects argument 'length' to be greater than 0.",
-                         CURRENT_FUNC);
+  if (length < 0 || length > ExternalTwoByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, ExternalTwoByteString::kMaxElements);
   }
   return Api::NewHandle(
       isolate, String::NewExternal(codepoints, length, peer, callback));
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewExternalString32(const uint32_t* codepoints,
                                                  intptr_t length,
                                                  void* peer,
                                                  Dart_PeerFinalizer callback) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   if (codepoints == NULL && length != 0) {
     RETURN_NULL_ERROR(codepoints);
   }
-  if (length < 0) {
-    return Api::NewError("%s expects argument 'length' to be greater than 0.",
-                         CURRENT_FUNC);
+  if (length < 0 || length > ExternalFourByteString::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, ExternalFourByteString::kMaxElements);
   }
   return Api::NewHandle(
       isolate, String::NewExternal(codepoints, length, peer, callback));
 }
 
 
 DART_EXPORT Dart_Handle Dart_StringGet8(Dart_Handle str,
                                         uint8_t* codepoints,
                                         intptr_t* length) {
   Isolate* isolate = Isolate::Current();
@@ skipping 130 matching lines @@
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
   const Object& obj = Object::Handle(isolate, Api::UnwrapHandle(object));
   return GetListInstance(isolate, obj) != Instance::null();
 }
 
 
 DART_EXPORT Dart_Handle Dart_NewList(intptr_t length) {
   Isolate* isolate = Isolate::Current();
   DARTSCOPE(isolate);
+  if (length < 0 || length > Array::kMaxElements) {
+    return Api::NewError(
+        "%s expects argument 'length' to be in the range [0..%ld].",
+        CURRENT_FUNC, Array::kMaxElements);
+  }
   return Api::NewHandle(isolate, Array::New(length));
 }
 
 
 #define GET_LIST_LENGTH(isolate, type, obj, len)                               \
   type& array = type::Handle(isolate);                                         \
   array ^= obj.raw();                                                          \
   *len = array.Length();                                                       \
   return Api::Success(isolate);                                                \
 
@@ skipping 2284 matching lines @@
     *buffer_size = 0;
   }
 }
 
 
 DART_EXPORT void Dart_InitFlowGraphPrinting(FileWriterFunction function) {
   Dart::set_flow_graph_writer(function);
 }
 
 }  // namespace dart